We need to update Apache Tomcat to 9.0.37 to pick up a fixes for high level CVEs:

https://nvd.nist.gov/vuln/detail/CVE-2020-9484
http://mail-archives.apache.org/mod_mbox/www-announce/202006.mbox/%3Cfd56bc1d-1219-605b-99c7-946bf7bd8ad4@apache.org%3E
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13935

This fix depends also on Meecrowave 1.2.10 (https://issues.apache.org/jira/browse/MEECROWAVE-251), and so is blocked until this is released.